We have a setup where 2FA = Enforce, and Shibboleth is enabled. When users choose the SSO login they are redirected to the idP, sign in there and are then return to Koha. But when they are returned to Koha they are asked to provide the 2FA OTP. If they do not have 2FA set up for their account they get a blue box with information about how to set it up, and a key/QR-code. I am not sure if this happens by accident or design, but it seems to me that signing in with the idP should be enough, and Koha should not ask for further "credentials". I might be wrong, though. :-)
Yeah, this is an interesting point. I can understand wanting to enforce 2FA/MFA on local logins but not SSO because your SSO Identity Provider might be enforcing 2FA/MFA on that end. I suppose there are Koha setups where people might want the 2FA/MFA on local logins and SSO though, so maybe we do need more options?
(In reply to David Cook from comment #1) > so maybe we do need more options? *hides from all the objects people might throw at him for suggesting more options/preferences*